Solved Why can't I truss pid 1


Active Member

Reaction score: 52
Messages: 134

Perhaps a silly question, but the subject says it all.

Output example (as root):
truss: can not attach to target process: Invalid argument

on: FreeBSD freebsd-virtual 11.1-RELEASE-p8 FreeBSD 11.1-RELEASE-p8 #0: Tue Mar 13 17:07:05 UTC 2018 amd64

Yet, I can do it on Solaris. Not sure about Linux, but that's irrelevant.


Deleted member 54719


Interesting...never considered the NEED to truss the init process. I'd have to think about how truss works, but I'd "guess" it reassigns the target process to a process group owned by truss command, which I'd also guess might be verboten, since init is suppose to be the God of processes. I could be 180 degrees off, but that's my guess without investigation.

Oops...Read the last sentence of below. I think that covers why it doesn't work.

The truss utility traces the system calls called by the specified process
or program. Output is to the specified output file, or standard error by
default. It does this by stopping and restarting the process being
monitored via ptrace(2).
Since you cannot "stop" the init process...